Rule Info
Name
DNS Query Request By QuickAssist.EXE
Author
Muhammad Faisal (@faisalusuf)
Description
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.
Date
2024-12-19 00:00:00
Modified
None
Id
882e858a-3233-4ba8-855e-2f3d3575803d
Tags
attack.initial-access attack.t1071.001 attack.t1210
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
z00t
Merge PR #5095 from @faisalusuf - Add new rules related to QuickAssist usage
2024-12-19
Scan your endpoints, forensic images or collected files with our portable scanner THOR